1500f761104965c6ba4d4e8cdc3524347f6b189fc95178569a37a1fa870a2eae | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 18:10

Sharing

Report Analysis Logs

General

Target

16fddb8ac4d11916c6920260593ddded_JaffaCakes118.dll
Size

3KB
MD5

16fddb8ac4d11916c6920260593ddded
SHA1

058ef57237f2898e77a3e65b8b3ded1371a831cd
SHA256

1500f761104965c6ba4d4e8cdc3524347f6b189fc95178569a37a1fa870a2eae
SHA512

41cfb9ff0455477b0025cfad30c99fe030ba49fcf836d959af8893cdd363429feccac3d9322986ae2b45201367b88ccae42dccd4bb36251a70644ea2ea222243

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2692	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28
PID 2080 wrote to memory of 2692	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16fddb8ac4d11916c6920260593ddded_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16fddb8ac4d11916c6920260593ddded_JaffaCakes118.dll,#1
  2⤵
  - Deletes itself
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads